CHAPTER 1 WhatsUp Flow Monitor Overview. CHAPTER 2 Configuring WhatsUp Flow Monitor. CHAPTER 3 Navigating WhatsUp Flow Monitor

Transcription

1 Contents CHAPTER 1 WhatsUp Flow Monitor Overview What is Flow Monitor?... 1 How does Flow Monitor work?... 2 Supported versions... 2 System requirements... 2 CHAPTER 2 Configuring WhatsUp Flow Monitor Determining which device sources to monitor... 4 Configuring Flow sources... 5 Monitoring traffic on non-standard ports... 8 Configuring data roll-up intervals... 9 Managing users and user rights...11 Setting the logging level...12 Backing up and restoring the Flow Monitor databases...13 Using the database backup and restore backup utility for Flow Monitor...13 Stopping or restarting the collector...14 Using Flow Groups...15 CHAPTER 3 Navigating WhatsUp Flow Monitor About the Flow Monitor Home page...16 About Flow Monitor database and service icons...19 Using the Flow Monitor Home page right-click menu...20 Searching reports for specific host names...21 CHAPTER 4 Using Flow Monitor reports About the Flow Monitor Reports tab...24 About the Interface Details report...25 General view...26 Managing report views...26 Selecting an interface...28 Filtering data in a view...28 About the Interface Overview report...33 Filtering report data...34 About the Flow Monitor Log...35 Filtering report data...36 Exporting report data...37 About the Bandwidth Usage report...37 i

2 Selecting an interface...38 Filtering report data...39 CHAPTER 5 Using Flow Monitor workspace reports Understanding Flow Monitor workspace reports...41 Flow Monitor workspace report types...42 Navigating workspace reports...43 Using the workspace report menu...44 Using links in Flow Monitor workspace reports...44 Using zoom controls on line graphs...45 Using informational tooltips...46 Configuring workspace reports...47 Filtering Flow Monitor workspace reports in WhatsUp Gold...48 Exporting workspace report data...49 Configuring export settings...49 Linking to Flow Monitor reports from WhatsUp Gold workspace reports...50 WhatsConnected - XHTML WhatsConnected - CHM Finding more information and updates ii

3 CHAPTER 1 WhatsUp Flow Monitor Overview In This Chapter What is Flow Monitor?... 1 How does Flow Monitor work?... 2 Supported versions... 2 System requirements... 2 What is Flow Monitor? WhatsUp Gold Flow Monitor is a network traffic monitor that lets you gather, analyze and report on network traffic patterns and bandwidth utilization in real-time. It uses NetFlow, sflow, and J-Flow (sampled NetFlow) network protocols to report information about the traffic on a router, switch, or other traffic-conducting network device. It highlights not only overall utilization for the LAN or WAN, specific device or interface, but also indicates users, applications and protocols that are consuming abnormal amounts of bandwidth. Flow Monitor works by collecting and summarizing the data that is carried over a device, and then transmitting that summary to another device, called a collector, for storage and analysis. Flow Monitor supports the NetFlow versions 1, 5, and 9 and sflow version 5. Flow Monitor is a software-based NetFlow collector designed for use on servers running Microsoft Windows operating systems. After configuring routers, switches, and other devices to transmit Flow summary data to Flow Monitor, you can view reports that allow you to: 1 View network usage trends to determine when to upgrade hardware to increase network capacity. 2 Recognize and correct network configuration issues that may needlessly consume network resources or expose your network to security vulnerabilities. 3 Identify traffic which may indicate undesired network usage, such as unauthorized use of peer-to-peer file sharing applications or a denial-of-service attack against your organization. 4 Troubleshoot and correct causes of spikes in network traffic before they become problems. 1

4 How does Flow Monitor work? When a router or other device sends flow data to Flow Monitor, it follows the process shown below. 1 The router gathers information about the traffic that is passing through it and summarizes that data into a NetFlow, sflow, or J-Flow (sampled NetFlow) export. 2 The router sends the flow export to the Flow Monitor collector. Note: sflow data is sent every x number of packets (configurable on the sflow device), whereas all NetFlow data is collected and monitored. This means that sflow data provides a sampling of network traffic data, whereas NetFlow data provides all network traffic data. 3 The Flow Monitor collector stores the NetFlow, sflow, or J-Flow (sampled NetFlow) export in the database. 4 When the report data is viewed on the web interface, Flow Monitor retrieves the data from the database and manipulates it to produce the report. Tip: WhatsUp Flow Monitor can collect and generate reports for Flow data from multiple devices. Supported versions Flow Monitor Monitor can receive and interpret data from NetFlow versions 1, 5, and 9, sflow version 5, and J-Flow (sampled NetFlow). System requirements WhatsUp Gold Flow Monitor has the same base system requirements ( as WhatsUp Gold. In addition, WhatsUp Gold Flow Monitor requires: 5 WhatsUp Gold Standard Edition, Premium Edition, MSP Edition, or Distributed Edition 6 At least one routing device that supports NetFlow version versions 1, 5, and 9 or sflow version 5. 2

5 7 MS SQL Server 2005 Standard or Enterprise Edition or MS SQL Server 2008 Standard or Enterprise Edition (recommended) Note: WhatsUp Gold Flow Monitor is more demanding on the database than WhatsUp Gold. While WhatsUp Gold Flow Monitor can successfully use SQL Server 2005 Express, we recommend either MS SQL Server 2005 Standard or Enterprise Edition or MS SQL Server 2008 Standard or Enterprise Edition for best performance. 8 2 GHz dual-core processor (required) to quad-core processor (recommended) 9 An additional 2 (required) to 4 GB RAM (recommended) GB (required) to 22 GB (recommended) hard disk space for the databases Note: If using Microsoft SQL Server 2005 or Microsoft SQL Server 2008, the database size is limited by available hard disk space. 3

6 CHAPTER 2 Configuring WhatsUp Flow Monitor In This Chapter Determining which device sources to monitor... 4 Configuring Flow sources... 5 Monitoring traffic on non-standard ports... 8 Configuring data roll-up intervals... 9 Managing users and user rights...11 Setting the logging level...12 Backing up and restoring the Flow Monitor databases...13 Stopping or restarting the collector...14 Using Flow Groups...15 Determining which device sources to monitor The information that Flow Monitor collects is influenced by the location of the flow sources relative to firewalls or other devices that perform network address translation (NAT). In short, the data is dependent on what and how the source sees. Carefully consider which routers or other Flow-enabled devices you want to configure to export flows to Flow Monitor to ensure that you see the type of data that you want to see. Depending on where the source is located relative to the device performing NAT, traffic to and from internal (private) IP address are reported differently in the exported NetFlow data. 11 If the source is inside the firewall, or if no firewall exists, the exported flow data includes the internal IP address for devices generating and receiving traffic. This allows you to pinpoint the exact device to which the traffic belongs. 12 If the source is outside the firewall, the exported flow data aggregates all traffic to and from internal devices and report it as belonging to the public address of the device performing NAT. In this case, you can only determine that an internal device originated or received traffic, but you cannot pinpoint the traffic as belonging to a specific internal device. 13 When the device exporting flows is also performing NAT, you can configure the device to export the flow data using either the private or the public NAT address, mimicking either of the above scenarios. To see internal IP addresses, configure the device to export data on ingress and egress for the internal interface. To see all traffic reported using the external IP address of the NAT device, configure the device to export data on ingress and egress for external interfaces. For more information, see Configuring NetFlow sources (on page 5). 4

7 Other conditions may also change the nature of the data reported by Flow Monitor. 14 If NAT occurs anywhere in the path between the source and the destination, IP addresses reported are altered to include the address of the NAT. In most cases, this does not present a problem, but it may require monitoring multiple flow sources to track traffic in complex network environments. 15 Virtual private networks and other tunneling technology (such as ESP or SSH) can appear to distort reports. In these cases, Flow Monitor reports large amounts of traffic sent over a small number of flows. This is expected behavior, as VPNs and other tunnels aggregate traffic from multiple connections and funnel it through a single connection. Configuring Flow sources Before you can view meaningful reports, you must configure Flow Monitor and Flow-enabled devices, such as routers or switches, to communicate network activity back to the Flow Monitor listener application. Configuring Flow sources is a three-part process that requires: Setting up Flow Monitor to listen for Flow data on the appropriate port. Configuring Flow devices to send Flow data to Flow Monitor. Setting options for the Flow source in Flow Monitor. To configure Flow Monitor to listen for NetFlow data: Note: By default, Flow Monitor listens for Flow data on port If you want to use that port, you do not need to perform this procedure. 1 From any workspace view or report in the web interface, select GO. The GO menu appears. If the Flow Monitor section is not visible, click Flow Monitor. The Flow section of the GO menu appears. 2 Select Configure > Flow Settings. The Flow Settings dialog appears. 3 In Listener port, enter the port number over which Flow Monitor should listen for Flow data. 4 Click OK to save changes. 5

8 To configure Flow devices to send Flow data to Flow Monitor: Caution: This procedure is an example that applies to a Cisco 1812 router and should not be used for other devices. The process for configuring a device to export Flow data varies widely from device to device and dependent upon your network configuration. Please see your router's documentation to determine the correct process for your device. 16 Step 1. Open the configuration interface for the router and enter the commands detailed in the following table to configure global options for all interfaces on the router. Command Purpose enable configure terminal Enters privileged EXEC mode. Enter your password if prompted. Enters configuration mode. ip flow-export version <version_number> ip flow-export destination <IP> <port> Sets the version of the NetFlow protocol that should be used to export data. Flow Monitor supports versions 1, 5, and 9 only. Enables the router to export Flow data. Substitute the Flow Monitor server's IP address for <IP> and the listener port specified in the Flow Monitor Flow Settings dialog for <port>. 17 Step 2. Enter the commands detailed in the following table to enable the router to export Flow data about the traffic on an interface. You must repeat these commands for each interface. Command Purpose interface <interface> ip flow ingress - or - ip flow egress Enters the configuration mode for the interface you specify. Substitute <interface> with the interface's name on the router. Enables Flow data export. Select the command that best fits your needs. 18 ip flow ingress exports flows of all inbound traffic that uses the interface. 19 ip flow egress exports flows of all outbound traffic that uses the interface. 6

9 Tip: If the device exporting Flow data is also performing network address translation (NAT), we recommend exporting egress data from the internal interface so that private network addresses are communicated. Any other configuration results in all private addresses reporting as the public addresses of the device performing the network address translation. Note: Other options exist for configuring NetFlow. For a complete list of available options, see Configuring NetFlow ( on the Cisco Web site. To configure options for Flow sources in Flow Monitor: 1 From any workspace view or report in the web interface, select GO. The GO menu appears. If the Flow Monitor section is not visible, click Flow Monitor. The Flow section of the GO menu appears. 2 Select Configure > Flow Sources. The Flow Sources dialog appears. 3 Select the source from the list, then select Edit. The Flow Source dialog appears. Note: If you cannot locate a source in the list, verify that the source device is set up to export Flow data properly. All devices sending Flow data to Flow Monitor automatically appear in the list. 4 In Display Name, enter a friendly name for this Flow source. This name is used throughout Flow Monitor to identify this source. 5 Verify that Collect data from this source is selected. 6 Set SNMP options. Flow Monitor uses SNMP to query information about the interfaces on the NetFlow source. a) Select the appropriate SNMP credentials. If the credentials you want to use are not included in the list, click the browse button (...) to open the Credentials Library. For more information on configuring credentials, see Using Credentials in the WhatsUp Gold User Guide. b) To set advanced options, such as timeout and number of retries, click Advanced. The Advanced dialog appears. Set the appropriate values, then click OK to return to the Flow Sources dialog. c) Select Query to query the router using SNMP to get updated names and speeds for the available interfaces. 7 Configure the speed of each interface, which is used to calculate capacity as a percentage of the total interface speed. a) Select an interface, then click Edit. The Flow Interface dialog appears. b) Select Hide this interface from the Flow Monitor Home page and related configuration properties to hide the selected interface from the Flow Monitor Home page and other menu options in Flow Monitor. This lets you display only the interfaces that are relevant to your bandwidth monitoring requirements. 7

10 Note: Null(0) interface names are hidden by default because they are not a true source interface. Null(0) interfaces show traffic that a router has dropped or traffic that a router has generated. In both cases the ifindex = 0 and as a default convention we name an interface = Null because the interface is none existent. If you want Null(0) interface information to display as a source interface, make sure that you uncheck the Hide this interface from the Flow Monitor Home page and related configuration properties option. c) Select Specify a custom speed for this interface. The In and Out fields are enabled. d) In In and Out, enter the upper limit of the interface in bps (bits per second). Common interface speeds expressed in bps are: 1 Gbps = 1,000,000,000 bps 100 Mbps = 100,000,000 bps 10 Mbps = 10,000,000 bps Note: Flow Monitor supports NetFlow versions versions 1, 5, and 9 only. If you export data using other versions of the NetFlow protocol or other protocols that are similar to NetFlow, such as IPFix or sflow, Flow Monitor discards the data. After you configure the listener port and set up Flow Monitor sources, Flow Monitor begins tracking data and generating reports. Monitoring traffic on non-standard ports Flow Monitor automatically classifies traffic for most common applications. However, in some cases, you may need to create a custom definition to ensure that Flow Monitor properly classifies some traffic. This need is most common when: Your device routes traffic for applications that use a proprietary protocol. This may be a custom program that uses a protocol developed in-house to send data across the network or a third-party application that uses its own custom protocol to transmit data. Your device routes traffic for standard applications over non-standard ports. Examples include a standard Web server running on a port other than 80 or an FTP client connecting to an FTP server that runs on a port other than 21. Note: For traffic to be considered unclassified, both the port that the data is sent from and the port to which it is received must not be classified in the Flow Ports dialog. If either of those ports are classified, the traffic is associated with the application of the classified port. To accommodate these cases, you can classify traffic that meets specific rules so that Flow Monitor reports that traffic as belonging to a certain application. 8

11 Important: You can configure the amount of time unclassified traffic data is kept. For more information, see Configuring data roll-up intervals (on page 9). Tip: If Flow Monitor detects a large amount of traffic to an unmonitored port, the Top Applications workspace displays a yellow warning flag that explains the situation and guides you in defining the unmonitored port. This can help you to proactively detect emerging nonstandard traffic on your network. You can also use the Unclassified Traffic dialog (available from any page in Flow Monitor by selecting GO > Configure > Flow Unclassified Traffic) to view all unclassified traffic since the last hourly rollup. To define rules for classifying traffic that uses non-standard ports: 1 From any workspace view or report in the web interface, select GO. The GO menu appears. If the Flow Monitor section is not visible, click Flow Monitor. The Flow section of the GO menu appears. 2 Select Configure > Flow Ports. The Flow Ports dialog appears. 3 Click New to configure a new port definition. The Flow Port dialog appears. 4 In Port, enter the port number over which the traffic is sent. 5 In Application, enter a name for the traffic that you are classifying. This should be the name of the protocol (for instance, the definition for port 80 includes HTTP as the application). 6 Select Monitor the following protocols on this port, and then select the protocols that the application uses (TCP, UDP, or SCTP). 7 Click OK to save changes. Configuring data roll-up intervals Flow Monitor is designed to serve two primary purposes: To give a minute-by-minute view of recent network traffic. To give an overview of historical network traffic. To accomplish these goals while keeping the size of its database reasonable, Flow Monitor uses a process of summarizing data at certain time intervals. By default, Flow Monitor rolls up data on this schedule: Complete raw data (which is collected every other minute and provides the detailed view of recent traffic) is kept for 4 hours. After 4 hours, raw data is summarized into hourly averages. After 1 days, hourly averages are summarized into daily averages. After 3 days, daily data is archived. After 7 days, archive data is purged from the archive database. 9

12 You can configure the intervals to roll up data more or less frequently depending on your network's size and traffic volume. To set data roll up time intervals: 1 From any workspace view or report in the web interface, select GO. The GO menu appears. If the Flow Monitor section is not visible, click Flow Monitor. The Flow section of the GO menu appears. 2 Select Configure > Flow Settings. The Flow Settings dialog appears. 3 Under Report Data, customize the roll up intervals to meet your requirements. Important: For recommended settings based on your network's size and characteristics, see the WhatsUp Flow Monitor Performance Tuning Guide Data collection interval. Select how often Flow Monitor writes collected data from its sources to the database. You may select 1, 2, 3, 4, 5, or 10 minutes. By default, data is written to the database every 2 minutes. Note: Modifying collection interval settings affects the granularity you see in Flow Monitor reports. If the interval is set to 5 minutes, you cannot distinguish traffic collected during the first minute from traffic collected during the fourth minute. Roll up raw data after. Enter the number of hours after which raw data collected from your Flow devices should be rolled up. This setting determines the number of hours of raw data that can be reported on at any given time. After data has been rolled up, Flow Monitor can report data usage for each hour, but detailed granular data (such as bytes, flows, and percentages) is aggregated into a single value for the entire hour. By default, raw data is rolled up after 4 hours. Caution: Modifying the roll-up settings directly affects the size of the Flow Monitor databases and the performance of the application. We recommend that you modify these settings cautiously, monitoring the effects on database size and application performance. Roll up hourly data. Enter the number of days after which hourly data should be rolled up into daily data. After hourly data is rolled up, Flow Monitor can only report aggregated totals for entire 24-hour blocks of time. By default, hourly data is rolled up after 1 day. Archive daily data. Enter the number of days after which daily data should be moved to the archive database. By default, daily data is archived after 3 days. Expire archive data. Enter the number of days after which daily archive should be purged from the archive database. By default, archive data is purged from the database after 7 days. Resolve private address interval. When the Flow Monitor collector service encounters an IP address, it tries to determine information about the host attached to the IP address. After this information is resolved, it is stored in the Flow Monitor database. Enter the interval (in hours) that you want Flow Monitor to wait, before it 10

13 checks the private IP address again, to resolve information that may have changed for the address. By default, private addresses are resolved every 48 hours. Resolve public address interval. When the Flow Monitor collector service encounters an IP address, it tries to determine information about the host attached to the IP address. After this information is resolved, it is stored in the Flow Monitor database. Enter the interval (in hours) that you want Flow Monitor to wait, before it checks the public IP address again, to resolve information that may have changed on the address. By default, public addresses are resolved every 720 hours. Tip: Because public IP addresses are less likely to be changed, you may want to use longer intervals than used for the Resolve private address interval option. Expire unclassified traffic after. Enter the number of hours after which Flow Monitor should purge unclassified traffic. Unclassified traffic is traffic transmitting over ports that are currently not monitored by Flow Monitor. By default, this option is set to 0 (zero), which causes Flow Monitor to aggregate and retain data for all unclassified ports as a single value; detailed information about the individual unclassified ports over which traffic was transmitted is immediately discarded. Note: The collector will purge any unclassified data that has no activity after the Expire unclassified traffic after value is satisfied. 4 Click OK to save changes. Important: Any changes made to data roll up intervals are not enforced until the Flow Monitor collector service is restarted. For more information, see Stopping or restarting the collector (on page 14). Managing users and user rights User accounts and user rights serve two purposes in Flow Monitor: User rights govern who can access Flow Monitor reports from, or add Flow Monitor workspace reports to, the main WhatsUp Gold web interface. User rights govern who can modify the Flow Monitor configuration. To grant a user the right to view Flow Monitor reports and data: Note: To complete this procedure, you must be logged in as a user who has been granted the Manage Users right in WhatsUp Gold. 1 From the web interface, select GO. The GO menu appears. If the WhatsUp section is not visible, click WhatsUp. The WhatsUp section of the GO menu appears. 2 Select Configure > Manage Users. The Manage Users dialog appears. 3 Select the user to which you want to grant rights to view Flow Monitor reports, then click Edit. The Edit User dialog appears. 11

14 4 Under User rights, in the Flow Monitor section, select Access Flow Reports. 5 Click OK to save changes. To grant a user the right to configure Flow Monitor: 1 From the web interface, select GO. The GO menu appears. If the WhatsUp section is not visible, click WhatsUp. The WhatsUp section of the GO menu appears. 2 Select Configure > Manage Users. The Manage Users dialog appears. 3 Select the user you want to allow to configure Flow Monitor, then click Edit. The Edit User dialog appears. 4 Under User rights, in the Flow section, select Configure Flow Monitor. 5 Click OK to save changes. To block a user from viewing Flow Monitor data for a specific Flow Monitor source: 1 From the web interface, select GO. The GO menu appears. If the Flow Monitor section is not visible, click Flow Mon. The Flow Monitor section of the GO menu appears. 2 Click Configure > Flow Sources. The Flow Sources dialog appears. 3 Select a source, then click Access Rights. The Flow Source Access Rights dialog appears. 4 To block a user or multiple users, select the specific user(s) from the list of usernames by clicking inside a check box in the Block Access column. Tip: You can Select All users, or Deselect All users. 5 Click OK to save changes. Note: In order for a user to be able to block access for other WhatsUp Gold users, the user must have the Manage Users access right. Additionally, the user for which you are trying to block access for should not have this right, as this will allow them to block access for other users. For more information on managing user accounts, see Managing Users in the WhatsUp Gold User Guide. Setting the logging level You can specify the level of information that is recorded for the Flow Log via the Flow Settings dialog. Note: The logging level that you specify on the Flow Settings dialog determines the level of data that Flow Monitor records, whereas the logging level that you specify on the Flow Log report page determines the level of data displayed within the report. 12

15 Important: Keep in mind that if you choose the Normal or Errors Only levels, you will not be able to view the Verbose level from the Flow Log report page. To set the Flow Monitor logging level: 1 From any workspace view or report in the web interface, select GO. The GO menu appears. If the Flow Monitor section is not visible, click Flow Monitor. The Flow section of the GO menu appears. 2 Select Configure > Flow Settings. The Flow Settings dialog appears. 3 Under General, select the Log level. Normal. Select this option to record errors and some general event information. Verbose Logging. Select this option to record more detailed information than normal logging. This option can create a large number of records and may be resource intensive; it is only recommended for use while troubleshooting issues. Errors Only. Select this option to record only events that register as errors. 4 Click OK to save changes. Backing up and restoring the Flow Monitor databases You can use the WhatsUp Gold database utilities to back up and restore the WhatsUp Flow Monitor database and archive database. To access the database utilities: From the WhatsUp Gold console main menu, select Tools > Database Utilities. Using the database backup and restore backup utility for Flow Monitor You can back up your complete Flow Monitor SQL Server database and archive database to any mapped directory you have on your network. Database backups are saved as.dat files and can be restored at any time. Restoring a.dat file overwrites your current database with the data in a.dat file. Important: Make sure that you close the Discovery Console before running a database restore. Running the Discovery Console while running a database restore could crash the console. Important: You can use this feature with any local instance of SQL Server whose databases are named Netflow and NFArchive. This feature does not work with remote databases. 13

16 Important: We strongly suggest that you backup and restore the Netflow database and archive database as a set. When you backup the Netflow database, you should also backup the archive database. Similarly, when you restore the Netflow database, you should restore the archive database to the version that was most recently generated by the Netflow database. If you want to back up the SQL database to a mapped drive, the Logon settings for the SQL Server (WHATSUP) (or your customized SQL service) must have write access to the mapped drive. To change the SQL database logon settings: 1 Click Start > Control Panel > Administrative Tools > Services, then double-click the SQL Server (WHATSUP) service. The SQL Service Properties dialog appears. 2 Click the Log On tab on the Properties dialog. 3 Change the account logon settings as required. Note: This is a complete backup and restore, so any change that you make after the backup will be overwritten and lost after restoring a backup. To access the Database Utilities Backup and Restore features: From the main menu in the WhatsUp Gold console, select Tools > Database Utilities > Back Up Flow Monitor Current or Archive Database - or - select Tools > Database Utilities > Restore Flow Monitor Current or Archive Database Stopping or restarting the collector You can restart the Flow Collector Service through Flow Monitor, WhatsUp Gold, and Windows. To stop or restart the Flow Collector Service through Flow Monitor: 1 From any workspace view or report in the web interface, select GO. The GO menu appears. 2 Click the Flow Monitor icon. The Flow Monitor Home page appears. 3 Click the Flow Service icon in the bottom right corner of the page. The Flow Service dialog appears. 4 Click Stop or Restart. A progress dialog appears as the Flow Data Collector Service stops. After the action is completed, the Flow Service dialog appears. 5 Click OK. To restart the Flow Collector Service through WhatsUp Gold: From the main menu of the WhatsUp Gold console, select Tools > Service > Restart Flow collector. The service restarts. 14

17 To stop or restart the Flow Collector Service through Windows: 1 Open the Windows Control Panel. 2 Select Administrative Tools > Services. The Services window appears. 3 Select Ipswitch Flow Collector, then click Stop. The service stops. 4 To restart the service, select Ipswitch Flow Collector again, then click Start. The service starts. Using Flow Groups In some cases, you may prefer to track a range of IP addresses as belonging to a different domain, top level domain, or country than the IP addresses resolve to. For example, internal IP addresses do not usually have host names registered on a domain name server, so Flow Monitor cannot automatically determine their domains, top level domains, or countries. To overcome this limitation, Flow Monitor lets you use Groups to override the domain, top level domain, and country of ranges of IP addresses so that each group can be tracked as a whole. This allows you to easily track sections of your internal network so that you can view reports by divisions, departments, or other groupings. Tip: After you configure a group, you can use that group's name to filter reports to show only the traffic sent to or received by devices that belong to the group. To create or edit a group: 1 From any workspace view or report in the web interface, select GO. The GO menu appears. If the Flow Monitor section is not visible, click Flow Monitor. The Flow section of the GO menu appears. 2 Select Configure > Flow Groups. The Flow Groups dialog appears. 3 Click New. The Flow Group dialog appears. - or - Select a group, then click Edit. The Flow Group dialog appears. 4 Enter or select the appropriate information in the following fields. Group. Enter a name for the Flow group. IP Range Start. Enter the first IP address for the Flow source group range. IP Range End. Enter the last IP address for the Flow source group range. Domain. Enter the domain that you want Flow Monitor to report for the specified IP addresses. For example, yourcompany.com. Top Level Domain. Select the domain that you want Flow Monitor to report for the specified IP addresses. For example, com. Country. Select the country that you want Flow Monitor to report for the specified IP addresses. 5 Click OK to save changes. 15

18 CHAPTER 3 Navigating WhatsUp Flow Monitor In This Chapter About the Flow Monitor Home page...16 Searching reports for specific host names...21 About the Flow Monitor Home page The Flow Monitor Home page provides overview information about the network sources that Flow Monitor is monitoring. Use this page to view high-level information about network traffic and flows and to drill deeper into each interface for more detailed information. You can also access Flow Monitor database and Data Collector Service information using the links at the bottom right side of the page. Flow Monitor sources The left side of the page lists each of the monitored sources and the interfaces associated with each source. 16

19 Flow Sources. Routers and switches that have been configured to send flow data to Flow Monitor and are enabled in Flow Monitor are listed in this column. In the list, sources are organized at the top level. Associated interfaces for each source are below the source name. Use the collapse and expand buttons to show or hide source interfaces. For each source, the number of flows per minute (fpm) for Flow devices and samples per minute (spm) for sflow devices generated by all interfaces on the selected source over the the last period is displayed. Note: Interfaces can be hidden; if you do not see an interface listed on this workspace report, check to see if it has been hidden via the Flow Interface dialog. Tip: If you do not see a source listed that you would like to monitor, first go to the Flow Sources dialog to configure source settings. If you still do not see the router listed, check to see that the router is configured to send flow data. For more information, see Configuring Flow Monitor sources (on page 5) or Configuring sflow sources. Incoming Interface Traffic. Incoming traffic is reported as a percentage of usage according to the interface's speed, and number of incoming bytes per second (bps) based on the last traffic to enter the interface. Outgoing Interface Traffic. Outgoing traffic is reported as a percentage of usage according to the interface's speed, and as the number of outgoing bytes per second (bps) based on the last traffic to leave the interface. Source and interface details The right side of the page gives detailed information about a selected source or interface. Note: If you have not enabled Flow sources at this time, a Welcome workspace report is displayed on the right side of the Flow Monitor Home page. Consult this workspace report for information on configuring your routers to send Flow data, and for other general Flow Monitor configuration information. Source details Click a source device in the list to view the Source details on the right side of the Home page. IP address. The source router's IP address. Flow protocol. The version of Flow or sflow the source uses when exporting flow data. Sample rate. The rate at which the source is polling interface data. Note: The sample rate appears for any source sending sampled NetFlow data. Packets received. The number of packets the collector received from the source since the collector service was started. Packets lost. The number of packets sent from the source but not received by the collector since the collector service was started. 17

20 Reliability. The percentage of packets received versus packets lost by the source since the collector service was started. Flow rate. The number of flows per minute (fpm) reported by the source during the last collection interval. Last active. The last time traffic was received from the source. Flow traffic status. Whether Flow Monitor is receiving traffic from the source; either receiving, or not receiving. Note: If any traffic has been received within the last 30 minutes, the traffic status is displayed as receiving. Use the Source Properties link at the bottom of the source details to view the Flow Source dialog and use the Interface links to view the WhatsUp Gold Interface Details report. Note: A link for the WhatsUp Gold Interface Details report appears only if the source is monitored in WhatsUp Gold. Interface details Click a source device interface in the list to view the Interface details on the right side of the Home page. The Interface Traffic report for the last collection interval is displayed at the top of the interface's details. Last incoming details. The last time traffic transmitted over the incoming interface. Last outgoing details. The last time traffic transmitted over the outgoing interface. Interface type. The type of the interface; for example, Ethernet CSMA/CD. In speed. The speed at which data is flowing to the interface. Out speed. The speed at which data is flowing from the interface. Status. The status of the interface; either Up, Down, or Unknown. Use the links at the bottom of the interface details to view the Interface Details and Interface Overview reports, as well as the Flow Interface Properties. Flow Monitor database and service icons Database and service icons are located in the bottom right of the page. These icons display information about the Flow Monitor database, archive database, and Flow Monitor service. Position the mouse cursor over an icon to view size and status information. For more information, please see About Flow Monitor database and service icons. Position the mouse cursor over the Flow Monitor Database icon to view the database edition and current size (in megabytes). Click the icon to view the Flow Monitor Database Properties. 18

21 Position the mouse cursor over the Flow Monitor Archive Database icon (located to the right of the Flow Database icon) to view the archive database edition and current size (in megabytes). Click the icon to view the Flow Monitor Database Properties. Position the mouse cursor over the Flow Service icon to view the service status. Click the icon to view the Flow Monitor Service Properties. Note: If you are using Internet Information Services (IIS) as the web server for WhatsUp Gold and it is running as a user that does not have administrative privileges, the web interface cannot interact with Windows services. This means that you cannot view the status of services or start, stop, or restart services from the web interface. In this case, you must log in to Windows to manage services through the Control Panel. Tip: Use the right-click menu on this page to view and configure parts of the application. For more information, see Using the Flow Monitor Home page right-click menu (on page 20). Tip: Use the Host Search tool in the upper-right side of the page to locate traffic to or from a host or group of hosts. For more information, see Searching for specific hosts (on page 21). Tip: Use the Alert Center tab to access the WhatsUp Gold Alert Center. About Flow Monitor database and service icons The Flow Monitor database, archive database, and service icons are displayed in the lower right corner of the Flow Monitor Home Monitor page. Position the mouse cursor over an icon to view size and status information. Icon Description When the database and archive database icons are green, the database sizes are at healthy levels. When the database and archive database icon are red, the database sizes are too large, or there is a database error. When the Flow Monitor service icon is green, the service is running. When the Flow Monitor service icon is red, the service has stopped. Flow Monitor Database Properties To view the properties for the Flow Monitor Database and Archive Database, click the database or archive database icons. 19

22 Using the Flow Monitor Home page right-click menu From the Flow Monitor Home page, you can right-click on a source or interface to access a right-click menu with links to common tasks. Note: The right-click menu shows options available for the object on which you right-click. Depending on the object you right-click, the available options may vary. The right-click menu includes these options: Reports. Select this option to open the Reports tab. Host Search. Select this option to open the Host Search dialog. From this dialog, you can search all sources and interfaces for traffic that uses a specific host. For more information, see Searching for specific hosts (on page 21). Interface Details. Select this option to view the Interface Details report for the selected interface. This report is a collection of views that provide quick insight into the traffic transmitting across a specific interface. Interface Overview. Select this option to view the Interface Overview report for the selected interface. This report is a collection of Flow Monitor workspace reports that provide a summary of the traffic and utilization of a specific interface. Configure. Select a configuration option: Flow Settings. Select this option to configure general settings in the Flow Settings dialog. Flow Sources. Select this option to open the Flow Sources dialog. From this dialog, you can view and change a device source configuration or stop and start data collection from a source, select a source and click Edit. Flow Ports. Select this option to open the Flow Ports dialog. From this dialog, you can see the definitions of applications (traffic over a given port using one or more protocols) that Flow Monitor is monitoring. You can also use this dialog to define new applications. 20

23 Flow Groups. Select this option to open the Flow Groups dialog. From this dialog, you can create, change, or delete an IP range of devices, in a Flow Group, that may not have been automatically associated with a domain, top level domain, or country. Flow Types of Service. Select this option to open the Flow Types of Service dialog. From this dialog, you can view and rename Flow Types of Service to make the Flow Top Types of Service workspace report more meaningful and easy to identify. Flow Unclassified Traffic. Select this option to open the Flow Unclassified Traffic dialog. From this dialog, you can map ports that have not been mapped to an application and are currently unmonitored. Flow Data Export Settings. Select this option to configure the parameters for exporting Flow Monitor report data. 20 Properties. Select this option to open either the Flow Source Properties dialog, or the Flow Interface Properties dialog. From these dialogs, you can view information about the selected source or interface properties. Searching reports for specific host names The Host Search tool allows you to search across the interfaces of all sources to find traffic to or from a specific host. The Host Search tool is available in several locations throughout Flow Monitor and WhatsUp Gold. Although the navigation to the Host Search tool varies, the search process is the same after you navigate to the feature. To perform a host search from the GO menu: 1 From any workspace view or report in the web interface, select GO. The GO menu appears. If the Flow Monitor section of the GO menu is not visible, click Flow Monitor. The Flow Monitor section of the GO menu appears. 2 Select Reports > Search. The Host Search dialog appears. 3 Select a search criteria from the list (contains, does not contain, is, is not, starts with, ends with). 4 Enter an alphanumeric search criteria in the blank field. 21

24 5 Click Search. After the search has completed, the dialog expands to display the search results list. 6 For more detail on a host in the list, select it, then click OK. The Flow Select Interface dialog for the selected interface appears. To perform a host search from the right-click menu: 1 From the Flow Home page, right-click a source or an interface. The Flow Home page right-click menu appears. - or - From the WhatsUp Devices tab, right-click a device. The WhatsUp Devices right-click menu appears. 2 Select Search from the Flow Monitor right-click menu, or Host Search from the WhatsUp right-click menu. The Host Search dialog appears. 3 Select a search criteria from the list (contains, does not contain, is, is not, starts with, ends with). 4 Enter an alphanumeric search criteria in the blank field. 5 Click Search. After the search has completed, the dialog expands to display the search results list. 22

25 6 For more detail on a host in the list, select it, then click OK. The Flow Select Interface dialog for the selected interface appears. To perform a host search from the Flow Home page or Reports tab: 1 From the Flow Home page or Reports tab, enter an alphanumeric value in Host Search, then press Enter. The Host Search dialog appears, populated with the results of the host search. The default search criteria for the host search is "contains." Adjust the search criteria as needed to perform the search you desire, then click Search. The dialog re-populates with the results of the new search. 2 For more detail on a host in the list, select it, then click OK. The Flow Select Interface dialog for the selected interface appears. 23

26 CHAPTER 4 Using Flow Monitor reports In This Chapter About the Flow Monitor Reports tab...24 About the Interface Details report...25 About the Interface Overview report...33 About the Flow Monitor Log...35 About the Bandwidth Usage report...37 About the Flow Monitor Reports tab The Flow Monitor Reports tab lists the available Flow Monitor reports. These Flow Monitor reports are available: Interface Details Interface Overview Flow Monitor Log Bandwidth Usage Interface Usage To view a report, double-click its title in the list. 24

27 Tip: You can access the WhatsUp Gold reports by clicking the WhatsUp Reports Quick Link. About the Interface Details report The Interface Details report is a collection workspace reports that provide quick insight into the traffic flowing through a specific interface. When you first access the Interface Details report, it shows the General view for all traffic on the selected interface. You can refine the report in several ways. Select a different interface. Use the Interface list at the top of the page to select the interface for which the report data displays. Changing the traffic direction. Use the Traffic direction list at the top of the page to select a direction for which the report data is displayed. Selecting a different date range. Use the Date range list at the top of the report to change the timeframe for which report data is displayed. If you select Custom, you will be prompted to enter a start and end time for the date range. For more information, see Filtering by date and time (on page 28). Filter report results. You can filter the current workspace reports to show only data matching search criteria. For more information, see Filtering by keywords (on page 30). You can also drill-down into certain report entries. For more information, see Filtering by drilling-down (on page 31). Managing report views. Use the Workspace View list at the top of the page to switch between the pre-configured report view and report views you've configured, or to create new report views. 25

28 Note: sflow data is sent every x number of packets (configurable on the sflow device), whereas typically all NetFlow data is collected and monitored. This means that sflow data provides a sampling of network traffic data, whereas Flow data provides all network traffic data. sflow data sampling methods may result in Interface Overview and Interface Detail reports that appear to have more or less traffic than is shown in the Flow Monitor Home page source information. This is because the sampled data shown in the Interface Overview and Interface Detail reports are derived the sampled data and the Flow Monitor Home page source information is derived from the total interface traffic data. For more information on how to refine the low Interface Details report, see Filtering data in a view (on page 28). Tip: You can view the Interface Overview (on page 33) report for the selected interface by clicking Interface Overview at the top of the page. General view The Flow Monitor Interface Details' main view is the General view. The General view displays an overview of traffic for the selected interface. By default, the report contains the following Interface Details workspace reports: Top Protocols Top Applications Top Senders Top Receivers Top Sender Domains Top Receiver Domains You can add additional Interface Details workspace reports to the General view, or delete an existing workspace report from both the Edit Layout button and the Workspace View list. For more information, see Managing Flow Monitor Interface Details report views (on page 26). Tip: Click Edit Layout to add a workspace report to the currently selected workspace view. Note: Sender workspace reports are displayed on the left side of the report, while receiver workspace reports are displayed on the right side. A page with no sender or receiver reports displays workspace reports in one column. Managing report views You can customize the default view, General, of the Flow Monitor Interface Details report, or create new views tailored to your needs. 26

29 To customize an existing view: 1 From any workspace view or report in the web interface, select GO. The GO menu appears. 2 Click the Flow Monitor icon. The Flow Monitor Home page appears. 3 From the list of Flow sources, select an interface. The Flow Monitor Interface Details report appears. 4 From the Workspace View list in the toolbar, select the view you want to customize. The view you select appears. 5 In the toolbar, click Edit View. The Configure Flow Interface Report dialog appears. 6 Customize the view. a) In View, enter a descriptive name for the view. This name appears in the View select list in the toolbar. b) From the list of available reports, select the checkboxes next to the names of the reports you want to include in this view. 7 Click OK to save changes. The customized Flow Interface Details report appears. To create a new Interface Details report view: 1 From any workspace view or report in the web interface, select GO. The GO menu appears. 2 Click the Flow Monitor icon. The Flow Monitor Home page appears. 3 From the list of Flow sources, select an interface. The Flow Monitor Interface Details report appears. 4 From the Workspace View select list in the toolbar, select Add View. The Configure Flow Interface Report dialog appears. 5 Configure the new view. a) In View, enter a descriptive name for the view. This name appears in the View select list in the toolbar. b) From the list of available reports, select the checkboxes next to the names of the reports you want to include in this view. 6 Click OK to save changes. The Flow Monitor Interface Details report appears and displays the new view. To delete a Flow Interface Details report view: 1 From any workspace view or report in the web interface, select GO. The GO menu appears. 2 Click the Flow Monitor icon. The Flow Monitor Home page appears. 3 From the list of Flow sources, select an interface. The Flow Monitor Interface Details report appears. 4 From the Workspace View select list in the toolbar, select the view you want to delete. The view you select appears. 5 From the Workspace View select list in the toolbar, select Delete Current View. You will be prompted to confirm you want to delete the current view. 6 Verify that you want to delete the view, then click Yes. The report view is deleted and the Flow Monitor Interface Details report appears. 27